On July 20, 2018, Boys Town National Research Hospital submitted a HIPAA Email Breach to the U.S. Department of Health and Human Services (HHS). Located in Boys Town, Nebraska, Boys Town's email breach affected 105,309 individuals’ protected health information. Boys Town National Research Hospital is classified as a Healthcare Provider. According to Boys Town's press release:
What Happened? On May 23, 2018, Boys Town became aware of unusual activity relating to an employee email account. Boys Town quickly launched an investigation to determine what may have happened and what information may have been affected, working together with computer forensics experts. The investigation determined that an unknown individual had access to the email account on May 23, 2018. Boys Town reviewed the email account to identify what personal information was stored within the email account. On or around July 3, 2018, Boys Town confirmed the personal information that may have been accessible as a result of the incident and the identities of the individuals relating to this personal information.
What Information Was Involved? The investigation in this matter confirmed that the following types of personal information related to Boys Town patients and employees may have been accessible as a result of the incident: name, date of birth, Social Security number, diagnosis or treatment information, Medicare or Medicaid identification number, medical record number, billing/claims information, health insurance information, disability code, birth or marriage certificate information, Employer Identification Number, driver's license number, passport information, banking or financial account number, and username and password. To date, Boys Town has not received any reports of the misuse of this information.
What is Boys Town Doing? Boys Town takes this incident and the security of personal information seriously. Upon learning of this incident, Boys Town moved quickly to confirm whether personal information may have been affected by this incident, to identify the individuals related to this personal information, to put in place resources to assist them, and to provide them with notice of this incident. Boys Town is reviewing its existing policies and procedures, and implementing additional safeguards to protect information stored in its systems. Boys Town reported this incident to law enforcement and is notifying state regulators, as required. Boys Town is also notifying potentially affected individuals and will be offering these individuals access to 12 months of free identity protection services.
HHS Wall of Shame
The HHS Wall of Shame is a website under the jurisdiction of HHS that lists all HIPAA breaches reported within the last 24 months. The Wall of Shame displays breaches that are currently under investigation by the Office for Civil Rights. As part of section 13402(e)(4) of the HITECH Act, the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals.
HIPAA Breach Report
The Paubox HIPAA Breach Report analyzes breaches that affected 500 or more individuals as reported in the HHS Wall of Shame.
Try Paubox Email Suite for FREE today.
